monarch-money-mcp-server

SUSPICIOUS. The skill's capabilities broadly match its finance-management purpose, but it operates on highly sensitive personal financial data, supports account-modifying actions, and is distributed from a personal repo that does not match the listed skill publisher. Data flow appears direct rather than obviously exfiltrative, so this is not confirmed malware, but the install trust and credential sensitivity make it medium risk.